e7009bc304e9322e619b78c4e7868bbaaf4e87b3
12 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Brummel
|
e7009bc304 |
fix(implement-loop): guard against a task discarding sibling tasks' uncommitted work
During a multi-task run nothing commits between tasks, so one task's file-level `git checkout -- <file>` / `git restore <file>` silently destroys an earlier task's uncommitted DONE work in a shared file. The loss was structurally invisible: spec- and quality-reviewers are scoped to the current task's footprint, diff_fingerprint only detects same-task repair cycles, and the end-of-iteration tree gate counts files (the surviving changes keep it nonzero). Observed in the wild as a PARTIAL run whose DONE reports did not match the tree. Two layers, both plugin-side (harness-level prevention is ruled out — decision log on the issue): Prose guard — implementer.md Step 8 no longer sanctions file checkout for scope curation: over-reach is undone by editing back, a broken intermediate state is repaired forward or reported BLOCKED (new fourth BLOCKED bucket in the status protocol). A matching Iron Law line in implement/SKILL.md covers all in-loop agents, whole-file and --patch; docs/conventions.md now marks the checkout discard idiom as the orchestrator's, between iterations. Mechanical guard — after every task of a multi-task run a snapshot agent records `git stash create` (a dangling commit; HEAD, index, and tree untouched — semantics verified empirically in a scratch repo) plus the `git diff HEAD --name-only --no-renames` path set. A path that was HEAD-modified at one boundary and gone at the next trips a hard BLOCKED naming the lost paths, the boundary, and the recovery snapshot sha (`git show <sha>:<path>`); the discard verdict outranks per-task outcomes in blocked_detail since the reports and the tree have diverged. Coarse by design, in both directions, and documented as such: a checkout-then-re-edit or a --patch hunk restore escapes the comparison (the snapshot keeps it diagnosable); a legitimate back-to-HEAD edit trips it (the verdict says adjudicate against the snapshot). --no-renames keeps a staged rename from reading as a loss; untracked files are outside the threat model (checkout cannot discard them). Cost: one sonnet/medium call per task, multi-task runs only; single-task and mini runs are unchanged. Verified: node --check on the async-wrapped script and a stub-agent harness — discard trips the hard BLOCKED and stops the loop; an accumulating happy path, a plan-intended deletion, a single-task run, and a dead snapshot agent all pass without a false positive. closes #23 |
||
|
Brummel
|
22aafe892a |
fix(workflows): fail fast on a malformed args carrier instead of misreporting it
Both workflow scripts destructured object-form `args` behind `args || {}`
only. A named-workflow invocation can deliver `args` as a string; a
non-empty string is truthy, so every carrier field silently read
`undefined` and the failure surfaced far from the cause: implement-loop
dispatched its plan-index agent against "Read the plan at undefined" and
stopped only via a mislabelled NEEDS_CONTEXT after burning agent calls;
compiler-driven-edit briefed its edit agent with "EDIT: undefined" and
mapped the agent's refusal onto the straddle-rule BOUNCE to specify —
a mechanics failure dressed as a design finding.
Guards now run before any agent dispatch, mirroring the existing
malformed-input pattern (the task_range guard):
- A string carrier is first JSON-parsed: a JSON-serialized object
carrier (a stringifying caller or substrate layer that still authored
the documented object form) is accepted; free text does not parse to
an object and is rejected.
- A carrier that is not an object (string, number, boolean, array) is a
distinct infra BLOCKED naming the received type (compiler-driven-edit:
kind bad-carrier) — never a bounce, never NEEDS_CONTEXT.
- Missing or blank required fields fail fast by name, per mode:
standard iter_id+plan_path, mini iter_id+red_test_path+cause_summary,
compiler-driven-edit edit_description+def_site. implement-loop also
rejects an unknown mode, since the required-field set keys off it.
String-form args are NOT a documented interface — the only invocation
examples in the plugin are object-form (implement/SKILL.md); the issue's
free-text-passthrough fix part was dropped on that ground (triage
verification on the issue). implement/SKILL.md now also documents the
infra early-exit end-report shape (minimal {status, iter_id, reason},
no BLOCKED.md, no blocked_detail) in the Iron Law exceptions, Step 2,
and Step 4's no-file special case.
Verified: both scripts pass node --check (async-wrapped, as the Workflow
substrate runs them) and a 17-case stub-agent harness — malformed
carriers block with zero agent dispatches; valid and JSON-serialized
object carriers reach the first agent unchanged.
closes #24
|
||
|
Brummel
|
d6c4faa3c0 |
fix(implement-loop): require positive edit evidence before DONE
The #11 vacuous-green shape on the main path: `outcome = DONE` was set purely from the absence of a BLOCKED task, with no check that the iteration actually wrote anything. `files_touched` was even computed by the finalize agent but never asserted > 0, `e2e.status` was never read, and in mini mode the handed-off RED test was never independently re-run (GREEN was asserted from the implementer's self-report, never observed). Add a positive-evidence precondition on DONE, taken from git ground truth — never a self-report, which must not be able to fail a run that actually did the work: - Standard mode: a dedicated `tree-check` agent runs `git status --porcelain | wc -l` after the per-task loop but BEFORE E2E/finalize. Zero (or a non-returning agent) downgrades DONE to BLOCKED. `git status --porcelain` (not `git diff HEAD`) so a brand-new untracked file — the implementer leaves edits unstaged — still counts; running pre-E2E/finalize keeps fixtures and the stats/BLOCKED.md artefacts from inflating it. - Mini mode: an independent `mini-verify` agent re-runs the RED test by name and the suite and checks the tree is dirty; a still-red test, a regression, or a clean tree is BLOCKED (route back to debug). - Per-task `applied_changes` (OR-ed across the initial dispatch and every repair) feeds only a neutral concern, never the outcome. - `e2e.status` is now read: a non-DONE status or a zero-fixture run surfaces as a concern. A clean-tree no-op is BLOCKED with no BLOCKED.md (nothing to clean up); the status + reason ride the end-report. SKILL.md documents the precondition, the no-BLOCKED.md carve-out, and the Step-4 handling. closes #12 |
||
|
Brummel
|
89cc4bb9a8 |
fix(compiler-driven-edit): require positive edit evidence before DONE
The done-signal `build_clean && suite_green_unchanged` was vacuously true on a clean working tree, so a no-op edit (the edit agent touched nothing and reported sites: 0) read as DONE. An orchestrator trusting that verdict would "commit the unstaged changes" — committing nothing under a DONE banner. Add positive evidence that an edit actually landed, checked at two independent points: - Phase 1 (cheap, pre-suite): the edit agent reports `applied_changes` as ground truth from `git status --porcelain` / `git diff HEAD`. No hole + clean tree -> distinct BLOCKED (kind: no-op-edit), skipping a pointless suite run against an empty tree. - Phase 3 (authoritative backstop): DONE now also requires the verify agent's independent `working_tree_dirty` observation. The verify agent never sees the edit agent's self-report, so a false applied_changes is still caught. A green build+suite over a clean tree routes to the same BLOCKED, not to debug (a clean tree is no regression — nothing to reproduce RED-first). The precondition keys on tree-dirty, not sites > 0: a legitimate behaviour-preserving edit can touch only the definition site (sites: 0) and still dirty the tree. Also fix the DONE note to report a legitimate sites: 0 as 0 rather than coercing it to null. closes #11 |
||
|
Brummel
|
52db1abe10 |
fix(implement-loop): hold plan-contradicting quality findings instead of oscillating to a false BLOCKED
The per-task quality re-loop treated every `changes_requested` as "deviate to satisfy", and the quality-repair dispatch was not even given the task text. When a finding's only remedy contradicted a plan-prescribed name/signature, the implementer renamed off-plan, the next review flagged "diverges from plan", and the loop oscillated name-misleads <-> diverges-from-plan until the retry cap, emitting a false BLOCKED on code that was green the whole time. Fix (issue's option 2 — the plan knowledge lives with the implementer, which holds the task text; the quality-reviewer is deliberately blind to it, so option 1 would have breached that separation): - The quality-repair dispatch now receives the task text and a HOLD CLAUSE. A cosmetic finding (plan kept => build+tests green) is KEPT and recorded in a new `held` field; the loop surfaces it as a concern instead of chasing a deviation. A finding the implementer judges correctness-breaking escalates to BLOCKED, never a silent hold. - The hold is keyed on two structural signals, never on a self-reported status enum (which the implementer contract overloads): the `held` array, and a no-op backstop over a required `diff_fingerprint` (a changes_requested verdict over an already-seen diff-state means the repair was a no-op or cycled back — re-running quality is futile). Fingerprints are tracked in a Set so A-B-A edit-then-revert is caught. - A no-op-backstop concern is labelled neutrally (a byte-identical diff cannot tell a principled plan-hold from an ignored bug); implement SKILL.md Step 3 now routes a held/unresolved quality finding to orchestrator hand-verification before committing, even under /boss. The held/no-op partition is the implementer's judgement, not enforced in code — the residual fail-open is bounded to cosmetic-on-green findings and disclosed, with the orchestrator's Step-3 inspection as the backstop, the same trust placed in its other self-reports. Verified across three rounds of adversarial review (held-the-plan paths, fail- open laundering, schema/Set mechanics) — all closed. closes #10 |
||
|
Brummel
|
eb74f99bd4 |
feat(boss): bolder autonomous /boss — grounding-PASS auto-sign, rollback sandbox, reference issue
Retire the obligatory five-lens spec-skeptic auto-sign panel (worst case 18 agent runs per spec under /boss). The autonomous signature is now the Step-5 grounding-check PASS alone — an independent fresh-context agent's verdict against currently-green tests; a no-override BLOCK/INFRA_ERROR routes to the human sign-off pause. The judgement the panel applied moves upstream into specify Step 1.5, whose stance inverts: a load-bearing fork the orchestrator can DERIVE an answer for (sources, code, consistency, risk) is decided boldly and recorded on the run's reference issue; only a pure-preference fork bounces. spec-skeptic survives as an optional ad-hoc bias-breaker the orchestrator pulls when unsure whether its leaning is judgement or bias — not a gate, not a veto. Every /boss run carries a mandatory reference issue (created if the cycle had none): the fork-decision log, the orchestrator's cross-run memory, and the only surviving trace of a hard-dropped attempt. Relax main-sacrosanct below the session anchor: within an autonomous run the orchestrator may git reset --hard its OWN UNPUSHED commits above the anchor on a dead end — never below the anchor, never a pushed commit (forward-only/revert). Discarded attempts are hard-dropped, no parking. Verified across the 9 edited files by a 4-lens adversarial review (retired-panel residue, cross-file contracts, rollback-boundary safety, stance coherence): unanimous SOUND. Baseline tagged pre-autosign-rework. closes #8 |
||
|
Brummel
|
7a58a530b1 |
feat(pipeline): route to the lightest correct methodology; move execution loops onto the Workflow substrate
The selector forced every task through the heaviest methodology's
critical path: a behaviour-preserving, type-enumerable change paid the
same specify -> planner -> implement front-half as a novel feature,
because it was neither new behaviour (tdd) nor an observed bug (debug)
and so fell to specify by elimination. Two coupled defects — a selector
with no verification axis, and an all-or-nothing executor — kept the
existing lighter path unreachable and uneconomical. This fixes both.
Part A — verification-keyed selector (boss/SKILL.md):
- Replace the three-way "design line" with an ordered cascade that adds
a verification/enumeration axis ahead of the settled-vs-fork question.
Each lighter arm carries a positive trigger matched by signature, not
reached by elimination.
- New `compiler-driven` arm: a type/signature edit at a definition site
that propagates mechanically. Observe-then-bounce — make the edit,
build, run the suite; clean build AND suite green unchanged commits;
a hole bounces up (specify for a design choice, tdd for discovered
test-specifiable new behaviour); a regression bounces to debug.
- The observed-bug RED-first gate is first in the cascade, so a
mechanical-looking fix cannot bypass it.
- The straddle rule ("add an enum variant") is codified as a rule:
mechanical/forwarding -> compiler-driven; encodes new behaviour ->
tdd/spec; doubt routes up.
- The executor is the elevated inline carve-out plus a shipped workflow,
not a heavy new skill ("the largest concrete win is small").
Part B — Workflow substrate (implement/workflows/):
- implement-loop.js: the per-task loop as a deterministic script. Each
phase (implementer -> spec-compliance -> quality, + tester for E2E) is
a separate top-level agent() call, so a single phase is independently
invokable and inter-phase aggregation/re-loop is code. Retires the
implement-orchestrator agent's inline-role-switch workaround (the four
phase agents survive as the agent-types the script dispatches).
- compiler-driven-edit.js: the observe-then-bounce loop.
- install.sh / uninstall.sh symlink shipped workflows into
~/.claude/workflows/.
- specify and brainstorm stay prose + interactive (human-intent oracle);
only the autonomous/mechanical loops moved. try-and-error is deferred.
Docs (pipeline taxonomy, design, agent-template, migration, README) and
all selector<->executor cross-references updated; the arm and its
executor are co-located so a future re-route through the full loop is a
visible regression.
Verified by an adversarial multi-agent pass: PASS on all six acceptance
criteria; two coherence concerns fixed. The shipped scripts are
syntax-validated but exercised only in a downstream target project (the
skills repo is not itself a pipeline target).
closes #7
|
||
|
Brummel
|
26e9630496 |
refactor: drop dev-cycle-profile.yml for conventions + CLAUDE.md facts
The profile was never parsed — it was prose the skill bodies told the model to read, so most slots were dead, constant across every project, or fiction (the whole pipeline block, including the "tdd is opt-in" claim, was enforced by nothing). Split it in two: constants become fixed conventions named directly by the skills (new docs/conventions.md), and the few genuinely per-project facts move to each project's CLAUDE.md under '## Skills plugin: project facts'. tdd/fieldtest/docwriter are now always available; the only behavioural toggle left is spec auto-sign. Delete docs/profile-schema.md and templates/project-profile.yml; add docs/conventions.md and a project-facts section to templates/CLAUDE.md.fragment; rewrite all SKILL/agent prose and the pipeline/design/migration/README/INSTALL docs accordingly. |
||
|
Brummel
|
137ec21e26 |
docs(tdd): wire sibling skills to the new entry path
The tdd skill referenced its neighbours (implement, brainstorm, debug) but none referenced it back. Close the loop so the new executable-spec-first entry path is reachable and consistent from every skill that describes a relationship it now belongs to: - implement: mini-mode trigger + dispatch example now cover a RED-first handoff from `debug` OR `tdd` (was debug-only); the orchestrator's task template and Phase-3 skip note generalised. This was real drift — mini-mode is no longer debug-exclusive. - planner: skip rule gains the `tdd` case (it skips brainstorm AND planner — the RED executable-spec is the plan). - brainstorm: `tdd` added to the permitted-skip list as the profile-gated alternative entry path, plus a cross-ref marking brainstorm as the bounce-back target when behaviour stops being test-specifiable. - boss: pipeline diagram, Step-3 routing prose, and cross-refs. A test-specifiable feature issue is dispatched to `tdd` autonomously, the same way a bug issue goes to `debug`; this is NOT a new-cycle bounce-back (the test is the spec). The bounce-back fires only reactively, when tdd surfaces a genuine design fork. - debug: reciprocal sibling note + cross-ref (new behaviour is tdd's job; debug is for regressions of existing behaviour). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Brummel
|
fc0e1d0d46 |
skills: cut blabla and redundancy from skill prose
Per-skill prose tightening from the same audit swarm; each finding passed an adversarial second reviewer. No behavioural change. - audit: drop garbled "Conventions require deferred audits to compound" sentence (says the opposite of intent; the preceding line already closes the loophole). - brainstorm: drop forward-pointing meta-comment about the Rationalisations table. - debug: drop third restatement that debugger.md is the single source for the carrier/handoff fields. - docwriter: drop motivational opener; Overview starts at the waste argument. - fieldtest: fold the 2-4-examples rationale into the dispatch sentence instead of restating the count a fourth time. - implement: drop "known platform constraint at the time" aside. - planner: cut the verbose anti-drift paragraph (which restated the very table it claimed not to) down to a cross-reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Brummel
|
0b969838c0 |
refactor: single-source carrier/handoff contracts across skills
Apply the debug-skill pattern (commits 6410732..de42974) to the remaining skills: the agent file is the single source for each interface field's semantics; the SKILL.md copy is reduced to field names plus a pointer, marking the agent's contract table authoritative. Because SKILL.md loads into orchestrator context and agents/*.md into the subagent's fresh system prompt with no transclusion, duplicated field tables drift apart over time. - brainstorm: carrier (spec_path/iteration_scope) -> grounding-check; the absolute-path requirement now lives only in the agent. - planner: carrier (spec_path/iteration_scope/focus_hint) -> plan-recon, including the mandatory/optional markers and the BLOCKED-on-missing rule SKILL.md had omitted. - fieldtest: carrier + produced fields -> fieldtester; the skill-level `status` roll-up (clean/friction_found/bugs_found/infra_blocked), which is not part of the agent's run-status protocol, stays defined in SKILL.md only. - docwriter: carrier + produced fields -> docwriter agent. - implement: carrier (iter_id scratch-dir/stats/not-a-branch semantics) -> implement-orchestrator; per-task sub-status vocabulary moved into the orchestrator-agent (it runs the loop in a fresh context and could not read SKILL.md at runtime, yet referenced "the sub-status table" by name); task_text_path single-sourced in implementer with spec-reviewer cross-referencing. audit was already the reference implementation (pointers, no restated contracts) and is unchanged. closes #2 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Brummel
|
22653e410a |
implement: skill + 5 agents migrated — migration complete
Eighth and final skill via the boss pattern. implement carries the per-task loop mechanics; implementer + spec-reviewer + quality-reviewer + tester are phase references the implement-orchestrator inhales at each role-switch. All eight skills + their agents now live in the plugin. AILang can switch over by dropping a project profile + removing its in-tree skills/ in a follow-up. Vocabulary substitutions: - AILang → "this project" - milestone → cycle - Boss → orchestrator (consistently) - ailang-implement-orchestrator → implement-orchestrator - ailang-implementer → implementer - ailang-spec-reviewer → spec-reviewer - ailang-quality-reviewer → quality-reviewer - ailang-tester → tester AILang-specific bits dropped or generalized: - `docs/plans/<iteration>.md` / `docs/specs/<milestone>.md` → `paths.plan_dir` / `paths.spec_dir` - `/tmp/ail-iter/<iter_id>/` → `/tmp/iter-<iter_id>/` - `bench/orchestrator-stats/` → `/tmp/iter-<iter_id>/stats.json` with note that a project-configured stats dir can be used - `cargo build --workspace` / `cargo test --workspace` → `commands.build` / `commands.test` - `examples/<name>.ail.json` → "fixture in the project's canonical fixture form" - `crates/ail/tests/e2e.rs` → "the project's E2E test location" - The entire AILang "Architecture rules (binding)" block in implementer (determinism via BLAKE3, LLVM text IR, schema ailang/v0, RC + bump allocator, Type::Fn effects, Implicit-mode rule) → generic "the binding architectural rules are declared in CLAUDE.md and the design ledger" - `git log --all --grep='or.2'` reference in implement-orchestrator → dropped (was AILang project history) - `bench/orchestrator-stats/<YYYY-MM-DD>-iter-<iter_id>.json` → generic stats path with project-configured option - AILang-specific quality-bar examples (Implicit-mode RC unflagged, libllvm call, schema break without migration note) → generic "anything that violates a binding architectural rule from CLAUDE.md / design ledger" - AILang-specific tester examples (`(show 42)` Int dispatch, ailang/v0 schema) → generic "feature X variant" / "API response" / observable-behaviour framing - `Brummel` references → dropped - `notify.sh` hardcoded → "the project's configured notification command" - `iter/...` branches (legacy AILang concept) → "iteration branches are not used" Universal substance preserved verbatim across all six files: - implement SKILL Iron Law (7 lines including new-cycle triggers and BLOCKED.md convention) - Per-task sub-status table (9 rows) - implement-orchestrator: 7-phase process (Phase 0 clean tree, Phase 1 context load mode-dependent, Phase 2 per-task loop with 4 sub-phases, Phase 3 E2E, Phase 4 BLOCKED.md, Phase 5 stats, Phase 6 end-report) - implement-orchestrator: BLOCKED.md template, stats.json schema, end-report fixed structure - implementer: TDD-first discipline, RED-first exceptions, 6-step process, 4-state status protocol - spec-reviewer: missing/unrequested-extra definitions, 7-step process, 4-state status protocol - quality-reviewer: 8 quality-bar categories, severity definitions, 6-step process incl. Strengths-first rule - tester: 4-clause Iron Law, "named property" doctrine, 4-state status protocol Common Rationalisations + Red Flags tables preserved across all six files with vocabulary substitution only. No discipline compressed. All seven sibling skills (boss, brainstorm, planner, debug, audit, fieldtest, docwriter) and the AILang reference agents now resolve correctly via `../<skill>/...` relative paths post-flatten. |